🔍 Read the full analysis: AI Meets Europe’s Supermarket Refrigeration Security Challenge on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
A second reported wave of remote attacks on supermarket refrigeration systems affected more than 115 stores across at least six European countries overnight on Nov. 1–2, according to BleepingComputer. Retailers and authorities reported disrupted temperatures and food losses, but the perpetrators and any role for AI remain unknown.
More than 115 supermarkets and other businesses across at least six European countries were affected overnight Nov. 1–2 after attackers reportedly accessed refrigeration controllers remotely and altered their settings, according to BleepingComputer. Retailers reported disrupted cooling and some food losses; authorities have not identified who was responsible, and there is no confirmation that AI was used.
Reports of incidents came from Belgium, the Netherlands, Sweden, Luxembourg, Ireland and Estonia. Finnish authorities and retailer Kesko also reported temperature problems at a few smaller stores. The precise total remains unsettled: accounts vary by outlet and retailer, and some reports include different types of businesses as well as supermarkets.
In Belgium, installer Sabcobel’s chief executive, Stephan Moelans, told Belgian media that technicians began disconnecting installations at about 1 a.m. He said roughly 20 of the several hundred installations his company manages were affected and described the method as the same as in France: evaporators had been switched remotely into defrost mode. He said Sabcobel itself was not hacked; the affected controllers in stores were reachable over the internet.
Retailers described disruptions at individual sites. Ahold Delhaize told BleepingComputer it had identified an IT incident affecting refrigeration systems in several dozen stores. Carrefour Belgium said 15 of its 700 stores were affected, involving a few refrigeration units, mainly freezers. Coop Sweden reported problems at seven of its more than 800 stores, while ICA said at least four affected stores operated outside its central network. Reports also named smaller independent shops, where equipment may not be covered by a chain’s central safeguards.
The reported impact varied. VRT NWS said a butcher in Antwerp detected the problem around 3 a.m. and shut down its systems in time. A Proxy Delhaize in Hoepertingen reported freezers at 15°C rather than about minus 22°C and estimated at least €60,000 in discarded food, according to a regional newspaper cited by VRT. Other outlets reported temperatures as high as 50°C at some sites. These are reported local readings, not a single temperature recorded across all affected stores.
Europe • Retail infrastructure • Incident brief
AI Meets Europe’s Supermarket Refrigeration Security Challenge
A reported second wave of remote attacks disrupted refrigeration in stores across Europe overnight on Nov. 1–2, 2026. The incidents expose the stakes of internet-connected equipment; who was responsible, and whether AI played any part, remain unknown.
01 / Geographic footprint
Six countries named in the reporting
Counts differ by outlet and retailer. Some totals include businesses beyond supermarkets, so the overall figure remains unsettled.
Finland’s cyber security authority and retailer Kesko also reported temperature problems at a few smaller stores.
02 / Store-level impact
One reported attack pattern, different local outcomes
The readings below come from individual reports. They are not a single temperature measurement across all affected locations.
Estimated value of food discarded after freezers reportedly reached 15°C, compared with about −22°C normally.
03 / How the exposure matters
Operational equipment can become a business risk
Refrigeration controllers manage temperatures for perishable food. A remote settings change can quickly move from an IT concern to an operational and financial one.
Reachable interfaces
Reports describe store controllers reachable over the internet. Public reporting has not established the exact credentials, vulnerability or access method used at each site.
Cooling interrupted
Evaporators were reportedly switched remotely into defrost mode; some outlets also reported heating modes. The effects and duration varied by location.
Systems beyond the center
Some affected shops were independently run or outside a chain’s central network. That raises questions about monitoring and safeguards across locally managed equipment.
04 / Reported sequence
A second wave follows an earlier episode in France
Similarities have been reported, but available information does not show that every site used the same equipment or experienced an identical sequence.
France reports a first wave of attacks on supermarket refrigeration systems.
The Paris prosecutor’s office counted roughly 700 victims in the earlier episode, according to source material.
CERT-FR warned that remote management interfaces were exposed online in ways that did not follow good practice.
A second reported wave affects businesses across multiple European countries.
05 / Evidence and uncertainty
AI is in the headline, not in the confirmed method
Authorities and retailers have not attributed the refrigeration incidents to artificial intelligence.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
Ahold Delhaize • statement to BleepingComputer
No perpetrator has been identified and no group has claimed responsibility in the cited reporting. Belgium’s federal prosecutor has opened an investigation. The full number of affected locations, total losses, duration of each incident and any data access remain unclear.
06 / What comes next
Investigation, equipment checks and clearer answers
Belgian authorities are investigating while retailers and refrigeration specialists respond to affected systems and check equipment.
Establish access
Determine how controllers were reached and whether incidents across countries can be linked to the same actor or campaign.
Review exposure
Check remote-management access, monitoring and available updates for refrigeration systems, including equipment outside central networks.
Clarify the scale
More consistent counts and documented loss estimates would help show the full operational impact.
Known: remote access to refrigeration controls is the reported security issue. Unknown: the responsible party, the complete access route and any role for AI.
Why Store Refrigeration Was Exposed
The incidents show how internet-connected building equipment can create operational and financial risks beyond conventional office IT. Refrigeration controls are responsible for maintaining temperatures for perishable food; a remote change can disrupt a store’s operations and, where cooling fails for long enough, lead to spoiled stock. The reported losses in Hoepertingen illustrate the potential cost, though a complete damage total is not available.
The reports also point to a difference between centrally managed chain locations and some independently operated stores. Colruyt said the affected Spar shops were run by independent entrepreneurs using their own refrigeration systems, and ICA described affected locations outside its central network. That does not establish that smaller or independent businesses were the only vulnerable sites, but it raises questions about how equipment is secured and monitored when it sits outside a retailer’s central systems.
The headline reference to AI should not be read as evidence that artificial intelligence powered the attacks. Belgium’s cyber centre has warned of a general increase in attacks partly involving AI, but officials and retailers have not attributed these refrigeration incidents to AI. The confirmed concern in the supplied reporting is remote access to control systems, not a verified AI technique.
Products Worth Considering
Samsung 34-Inch Odyssey G5 Ultra-Wide Curved Gaming Monitor
LG UltraGear 27GX704A-B 27-inch QHD OLED Gaming Monitor
LG UltraGear 32GX850A-B 32-inch 4K UHD Glossy OLED Gaming Monitor
As an affiliate, we earn on qualifying purchases.
A Second Refrigeration Attack Wave
The Nov. 1–2 incidents followed a reported wave in France on the night of Oct. 11–12. The Paris prosecutor’s office counted about 700 victims in that earlier episode, according to the source material. France’s national cybersecurity agency, CERT-FR, warned on Oct. 12 that remote management interfaces for refrigeration controllers were exposed online in ways that did not follow good practice. It said attack campaigns were probably still ongoing.
Belgian installer Sabcobel said the method in the later incidents matched the French wave: refrigeration evaporators were reportedly switched into defrost mode remotely. Finland’s National Cyber Security Centre said attacks in Finland and elsewhere targeted specific Danfoss models, according to news agency STT. The source material does not establish that every affected store used the same equipment or that every incident followed an identical sequence.
The current reporting draws on statements from retailers, installers and authorities, alongside coverage by broadcasters and news outlets including RTL, VRT NWS, TV4, NOS and BleepingComputer. Store counts differ across reports. For example, the source cites estimates of more than 115 affected sites across countries, while Belgian totals vary depending on which retailers and locations are included.
“We have identified an IT incident affecting the refrigeration systems in several dozen stores.”
— Ahold Delhaize
Who Accessed the Controllers
No perpetrator has been identified, and no group has claimed responsibility in the reporting provided. Belgium’s federal prosecutor has opened a criminal investigation. Belgium’s cyber centre has warned that investigators may never identify the attacker.
The total number of affected locations and the full value of losses remain uncertain. Published counts differ, and individual reports describe different temperature readings and impacts. It is also not clear from the available information how long each system was affected, whether any personal or business data was accessed, or whether every incident has been linked to the same actor.
Although the source material discusses AI in its headline and broader cybersecurity context, no source cited here says AI was involved in carrying out these attacks. The initial access route is described as internet-reachable controller interfaces, but the precise vulnerability, credentials or other method used to reach each device has not been established publicly.
Investigation and Store Safeguards
Belgium’s federal prosecutor is investigating, while retailers and refrigeration specialists have been responding to affected systems and checking equipment. The next publicly useful information would include findings on how the controllers were accessed, whether investigators can link the incidents across countries, and a clearer count of affected businesses and losses.
France’s CERT-FR had already warned that exposed remote-management interfaces were a risk and said campaigns might continue. The reporting does not confirm whether every affected operator has applied available updates or changed remote-access settings. Retailers and authorities may provide further guidance as investigations develop; until then, the scope, attribution and any AI involvement remain unconfirmed.
Key Questions
How many businesses were affected?
BleepingComputer reported more than 115 stores across at least six countries. Finnish authorities and Kesko also reported problems at a few smaller stores. Counts differ between reports, so the final total is not confirmed.
What did attackers reportedly do to the refrigeration systems?
Installer Sabcobel said evaporators were switched remotely into defrost mode, matching the method reported in the October attacks in France. The exact access method used at each site has not been made public.
Was AI used in the attacks?
That has not been established. Belgium’s cyber centre has discussed AI in relation to broader attack trends, but no cited authority or retailer has said AI was used in these incidents.
Who is responsible?
No attacker has been identified, and there has been no claim of responsibility in the reporting provided. Belgium’s federal prosecutor has opened an investigation.
Were all affected stores part of major chains?
No. Reports include chain locations as well as independent shops and smaller businesses. Some retailers said affected stores operated outside their central networks or safeguards, though the available information does not establish that this applied to every affected site.
Source: ThorstenMeyerAI.com
